Plain-language summary
The Cognisee investigation surfaced a question the seed does not answer: when the domain layer (C5) is built, can a referenced domain point at a system outside Loomworks — a third-party reasoner, an external knowledge service — or only at internal Loomworks scopes?
This note scopes that question. It does not answer it; it frames what must be decided, names what the seed already commits, names what breaks if external references are allowed, and names the work each answer implies. The decision is the Operator's. What this note settles is the shape of the decision.
One thing to fix first, surfaced by GRANTHA. Seed v0.12 describes access restriction as "an ACL established through OVA." That vocabulary is now stale on two counts, not one: the substrate is GRANTHA (consuming OVA), and GRANTHA has no ACL and no group object at all. This note flags the seed correction; it does not make it.
In scope: the external-reference decision and its consequences across reach, contribution, provenance, and Rendering. Out of scope: building C5, designing the integration, GRANTHA's internal model, commercial terms.
The correction this note carries
Three prior positions are corrected here. Each is named, not smoothed.
Prior position (seed v0.12, my two prior Cognisee notes): access restriction is "an access-control list established through OVA."
Correction, from GRANTHA v0.3:
- Substrate. The access-control seat is GRANTHA, not OVA. GRANTHA is a standalone access-grant product that consumes OVA (as Tessera does). OVA is not gone — it does the blind, topology-hiding ZK verification underneath. GRANTHA is the grant model layered over it. "ACL via OVA" → "reach governed by a grant, verified blind by OVA under GRANTHA."
- No ACL, no group. GRANTHA's founding move is that there is no access-control list and no group object. There is one primitive — the grant. "Restricted" does not mean "a list names who's allowed"; it means "a grant is required, and the holder proves they hold it in zero knowledge." The holder-set "never exists as a readable object." So the seed's word ACL is itself wrong under GRANTHA, independent of the substrate rename.
- What "restrict" means. Under GRANTHA's assume-breach / hidden-topology posture: open = no grant required to reach the scope; restricted = a grant is required and is proven blind. An observer with full read access cannot see who holds reach. This is stronger than the seed's "ACL governs who may reach," and the strength matters below.
Seed is behind on this
Seed v0.12 predates GRANTHA v0.3 (2026-06-07 vs 2026-06-20). Per the seed's own rule — when seed and current intent disagree, the seed governs and the disagreement is surfaced — this note surfaces it. A future seed version absorbs the GRANTHA substitution and drops the ACL vocabulary. Until then, read every "ACL via OVA" in the canon as "grant via GRANTHA, verified by OVA."
What the seed already commits
The seed gives the domain layer three load-bearing commitments, all written as if both ends of a reference live inside Loomworks:
- Reference is a real relationship, distinct from membership. An engagement "references" domains — "the domains it reaches for relevant practice and material." Reference is many; peers, none above the other. Membership (one chain) is the other relationship and is not this one.
- Reach is open by default. A scope is reachable by any engagement until a grant restricts it. (Seed says "ACL via OVA"; read "grant via GRANTHA.")
- Provenance is mandatory and typed. A contribution "carries who contributed it, when, how — typed, spoken, extracted from a document." Origin is recorded automatically.
What the seed is silent on: whether the far end of a reference can be a non-Loomworks system. Every mechanism above assumes both ends are internal. The seed does not forbid external references; it does not contemplate them. That silence is the scoping gap.
The decision, stated precisely
Can a C5 referenced-domain target resolve to a system outside Loomworks?
Not "should we integrate Cognisee" — that is a downstream commercial question. The seed-level decision is structural:
Is a referenced domain always an internal Loomworks scope, or can it be an external endpoint that Loomworks reaches but does not hold?
Three positions are available. This note frames all three; it does not pick.
Position 1Internal-only
A referenced domain is always internal Loomworks Memory. External knowledge enters only by being contributed in (a person or process writes Cognisee-derived material into a Loomworks scope, marked as such), never by live reference to an outside system.
Cleanest against the seed. Every existing mechanism holds unchanged. Provenance is preserved because the external material became a normal contribution at the moment it entered, carrying its origin marking.
Cost: no live external reference. Cognisee's value arrives only as snapshots someone imports, not as a domain an engagement reaches at Shaping/Rendering time.
Position 2External-reference, read-only
A referenced domain may be an external endpoint Loomworks reaches for reading. The engagement reaches out at Shaping time; what returns is treated as contribution arriving from a typed external origin. The investigation's "Direction 1" lives here (Cognisee → Loomworks).
What it requires (each a scoping sub-question, not solved here):
- A new provenance origin type. The seed's enumerated origins do not include "inference returned by an external reasoner." C5 would add one. The rule extends cleanly — origin is "extensible, threads walkable" per standing direction — but the new type must be defined.
- A reach-grant question for GRANTHA. If the external domain is restricted, what does a GRANTHA grant mean when the resource is outside Loomworks? GRANTHA verifies a holder may reach a resource-scope; an external endpoint is a resource GRANTHA does not control. Does GRANTHA govern Loomworks's right to reach out, or is the external system's own access control the boundary, or both in series?
- Freshness / liveness semantics. An internal Manifestation is a reading at a moment in time. An external reference is live. C5 must decide whether an external reference is snapshotted on reach (becoming a dated contribution) or held as a live edge (and if live, how lineage records a thing that can change).
Position 3External-reference, read and contribute
As Position 2, plus Loomworks may contribute out to the external system. The investigation's "Direction 2" lives here (Loomworks → Cognisee), and so does its boundary tension.
What it requires, beyond Position 2:
- The gated-contribution posture, pointed outward. The seed gates contribution to shared scopes. Contributing out of Loomworks is the same posture inverted — a deliberate, recorded, operator-authorized act, never a default. GRANTHA is the natural place this grant lives: "may contribute Loomworks Memory to external endpoint X" is itself a grant, subject to the six composition rules (separation of duties, no self-grant, dual-control on catastrophic acts, mandatory audit via FORAY).
- The provenance-at-the-boundary tension. Loomworks can mark and record what it sends; it cannot make the external system preserve provenance downstream. A boundary condition to surface, not engineer away. GRANTHA + FORAY make the outbound act auditable; they cannot govern what happens past the boundary.
Cross-cutting consequences (Positions 2 and 3)
Four seed surfaces feel an external reference. Each is a C5 design item, flagged not solved:
- Provenance model — needs the external-origin type. Standing direction already wants origin "extensible, threads walkable," so this is an anticipated extension, not a violation.
- GRANTHA grant semantics for external resources — the genuinely new question. GRANTHA's grant is over a resource-scope; an external endpoint is a resource Loomworks does not own. Whether GRANTHA governs the reach-out, the contribute-out, both, or neither is undecided and is the hardest sub-question. It should be checked against GRANTHA's own open questions (its C2) rather than decided unilaterally here.
- Rendering lineage — the seed commits that every Render records "which scopes' knowledge it composed." A Render composing external-domain material must record that an external scope contributed, and be honest that the contribution is a reach-snapshot, not held Memory.
- Mode B adjacency — the seed's Rendering Mode B already crosses the Loomworks boundary outbound (Loomworks produces a spec an external system consumes). External reference is the inbound/bidirectional analogue at the Memory layer. Different layers — should not be merged — but Mode B is precedent that the seed already tolerates a Loomworks↔external boundary at one layer.
Recommendation on sequencing (not on the decision)
This note does not recommend which position to adopt. It recommends when to decide:
- The decision gates on GRANTHA, not the reverse. Positions 2 and 3 both turn on "what does a GRANTHA grant mean for an external resource," and GRANTHA is itself pre-seed (Discovery v0.3, nothing built). Deciding external-reference policy before GRANTHA's grant-policy expression is settled would be deciding on a substrate that isn't specified.
- Therefore: carry this as a C5 open question, explicitly coupled to GRANTHA's C2. When GRANTHA's grant model lands, this decision becomes answerable. Until then, Position 1 (internal-only) is the safe default — it requires nothing new and loses only live external reference, which nothing currently needs.
- The Cognisee relationship does not stall on this. Cognisee material can enter as ordinary contribution (Position 1) today, marked as Cognisee-derived. Live reference (Positions 2/3) is the enhancement that waits on GRANTHA.
What this note does not settle
- Which position to adopt. Operator's decision, gated on GRANTHA.
- C5 build scope. This is pre-CR; no requirements, no steps.
- GRANTHA's grant semantics for external resources. Belongs to GRANTHA's own scoping (its C2), referenced here, not decided here.
- Any Cognisee-specific integration. Commercial and downstream.
- The seed amendment. The GRANTHA substitution and the ACL-vocabulary drop are flagged for a future seed version; this note does not author that amendment.
Open questions, consolidated (for the C5 scoping session)
- Internal-only, external-read, or external-read-and-contribute? (The core decision.)
- What is the new provenance origin type for external-reasoner inference, and how does it mark on the contribution? (Positions 2/3.)
- What does a GRANTHA grant mean when the resource-scope is an external endpoint Loomworks does not own? (The hard one; coupled to GRANTHA C2.)
- Snapshot-on-reach or live edge for an external reference? How does lineage record something that can change? (Positions 2/3.)
- If contribute-out is allowed (Position 3), is the outbound grant subject to all six GRANTHA composition rules, and which are dual-control? (Position 3.)
- Does the seed's Rendering-lineage commitment need amending to distinguish held-Memory scopes from reach-snapshot external scopes? (Positions 2/3.)
Version history
- v0.1 (2026-06-26) — First draft. Scopes the C5 external-reference-target decision arising from the Cognisee investigation. Carries the OVA→GRANTHA correction and the deeper no-ACL/no-group correction from GRANTHA v0.3. Frames three positions, names cross-cutting consequences, recommends sequencing (gate on GRANTHA; Position 1 safe default meanwhile). Does not decide.
DUNIN7 — Done In Seven LLC — Miami, Florida · C5 Domain Layer — External Reference Targets — Scoping Note — v0.1 — 2026-06-26